MGASA-2022-0052

    Dashboard / Vulnerabilities / MGASA-2022-0052

    MGASA-2022-0052

    Published: 8 Feb 2022Last Modified: 16 Apr 2026
    Upstream:
    CVE-2021-3999

    Summary: Updated glibc packages fix security vulnerability

    Details: Updated glibc packages fix security vulnerability: An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system (CVE-2021-3999). Other upstream fixes in this update: - gconv: Do not emit spurious NUL character in ISO-2022-JP-3 [BZ #28524] - x86: Fix __wcsncmp_avx2 in strcmp-avx2.S [BZ #28755] - x86: Set Prefer_No_VZEROUPPER and add Prefer_AVX2_STRCMP - x86-64: Add ifunc-avx2.h functions with 256-bit EVEX - x86-64: Add strcpy family functions with 256-bit EVEX - x86-64: Add memmove family functions with 256-bit EVEX - x86-64: Add memset family functions with 256-bit EVEX - x86-64: Add memcmp family functions with 256-bit EVEX - x86-64: Add AVX optimized string/memory functions for RTM - x86: Add string/memory function tests in RTM region - x86-64: Use ZMM16-ZMM31 in AVX512 memset family functions - x86-64: Use ZMM16-ZMM31 in AVX512 memmove family functions - test-strnlen.c: Initialize wchar_t string with wmemset [BZ #27655] - test-strnlen.c: Check that strnlen won't go beyond the maximum length - x86: Optimize memchr-avx2.S - x86: Fix overflow bug with wmemchr-sse2 and wmemchr-avx2 [BZ #27974] - x86: Optimize strlen-avx2.S - x86: Optimize memchr-evex.S - x86-64: Fix an unknown vector operation in memchr-evex.S - x86-64: Move strlen.S to multiarch/strlen-vec.S - x86-64: Add wcslen optimize for sse4.1 - x86: Fix overflow bug in wcsnlen-sse4_1 and wcsnlen-avx2 [BZ #27974] - x86: Optimize strlen-evex.S - String: Add overflow tests for strnlen, memchr, and strncat [BZ #27974] - x86-64: Require BMI2 for __strlen_evex and __strnlen_evex - x86: Check RTM_ALWAYS_ABORT for RTM [BZ #28033] - x86: Black list more Intel CPUs for TSX [BZ #27398] - x86: Remove wcsnlen-sse4_1 from wcslen ifunc-impl-list [BZ #28064] - x86-64: Test strlen and wcslen with 0 in the RSI register [BZ #28064]

    References: https://advisories.mageia.org/MGASA-2022-0052.html, https://bugs.mageia.org/show_bug.cgi?id=29935

    Affected packages

    Package

    Name: glibc

    Purl: pkg:rpm/mageia/glibc?arch=source&distro=mageia-8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.32-25.mga8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High